Online casinos in Spain

Licensing of online casinos in Spain

In 2011 Spain unified its online gambling regulation with Law 13/2011. Since then, the market has been regulated by the Dirección General de Ordenación del Juego (DGOJ), now part of the Ministry of Social Rights, Consumer Affairs and the 2030 Agenda. The DGOJ issues licences, supervises the market and, where necessary, sanctions operators nationwide. It also runs a number of player services — from self-exclusion tools to alerts about identity theft. Lotteries are overseen separately by SELAE and ONCE.

A Spanish licence is far from a formality. Operators must work on a dedicated .es domain and redirect all Spanish traffic from any other group sites to that domain. On the technical side, they are required to run a Central Gaming System and an Internal Control System (Sistema de Control Interno) that records every session, bet, payment and balance change. The regulator has secure access and receives a real-time data feed. Random Number Generators and all other critical components must be certified and re-audited every two years under Real Decreto 1613/2011, while licensing and accounting rules are set out in Real Decreto 1614/2011.

Player verification and responsible gambling are built into the system by default. Every account has to be verified; minors and anyone listed in the Registro General de Interdicciones de Acceso (RGIAJ) are blocked from playing, and issuing gambling credit is strictly prohibited. Spain also applies standard deposit caps: €600 per day, €1,500 per week and €3,000 per month. You can set lower personal limits yourself; raising them requires enhanced checks and is rarely approved. For the “Other games” category (casino), you must set a maximum session length and loss limit in advance; reaching either will automatically end your session, and the site must display periodic summaries on your screen. If you request a withdrawal of your available balance or winnings, the operator has to initiate the payout within 24 hours.

Advertising is tightly controlled (Real Decreto 958/2020). Marketing messages must be clearly labelled, must not target minors and cannot glamorise gambling. Promotions, including “welcome” offers, are only allowed for verified active customers and under strict conditions. Operators must have a prominent safer gambling section (“Juego más seguro”), a free helpline and a staff training programme. A 2023 decree (Real Decreto 176/2023) further strengthened protections for young adults and players with risky or “intensive” patterns: no promotions, no VIP benefits, tighter payout rules and suspension of activity if the customer fails to respond to the operator within 72 hours (and until a response is received).

Where rules are breached, the DGOJ can step in. For very serious violations (such as operating without a licence, bypassing the .es domain or tampering with certified software) fines range from €1 million up to €50 million, with possible licence revocation and bans of up to four years. Serious infringements can mean fines of up to €1 million and suspension of operations. The DGOJ publishes its sanction decisions and can order payment providers, media companies and telecom operators to stop serving illegal gambling sites.

Protection of funds and data. Operators must keep player funds in segregated accounts in Spanish banks, separate from their own corporate money, and fully apply AML/KYC procedures. Players also benefit from national tools: registering in the RGIAJ self-exclusion system blocks your access to all licensed operators, while the “PhishingAlert” service notifies you if someone attempts to open an account using your personal details.

Cryptocurrencies. The regulatory framework favours traceable, PSD2-compliant payment methods with clearly identified account holders. DGOJ guidelines assess the risk profile of any payment method (including those that can be funded via crypto channels), but consumer protection rules do not allow direct deposits in cryptocurrency. In practice, .es-licensed sites rely on regulated payment gateways that verify and match the account holder’s name.

Limits and taxes

Player limits operate on two levels. First, the law sets general deposit caps of €600 per day, €1,500 per week and €3,000 per month, unless you choose stricter personal limits. Any request to increase limits is subject to responsible gambling checks and can only be approved once every three months. Second, casino sessions under the “Other games” licence must run with explicit time and loss limits; hitting either automatically ends the session. In live betting, your total exposure cannot exceed the available balance at the start of the event (you may use interim winnings only within that same event).

In Spain, gambling taxation primarily targets operators rather than players directly. Law 13/2011 introduced a gambling tax, with rates depending on the product and tax base. Examples from the law: “Other games” (casino-style products) are taxed at 25% of net gaming revenue; contests at 20% of gross revenue; fixed-odds sports betting and other fixed-odds wagers at 25% of net revenue; mutual (totalisator) bets at 15–22% of gross stakes. Autonomous communities can add a surcharge to the portion attributable to their residents (up to 20% of the base state rate). The annual budget law may adjust bases and tax rates. This section does not cover income tax on player winnings.

How to verify a Spanish gambling licence

Start with the casino itself. Legal operators use a .es domain, clearly display their licence information (often under “Juego autorizado” or in the site footer), show the “Juego Seguro” logo and RGIAJ/18+ symbols, and maintain a visible “Juego más seguro” (safer gambling) section. Be wary of brands operating only on .com domains or apps that lack the mandatory Spanish warnings and labels.

Next, check the operator in the official register. The DGOJ maintains an up-to-date list of licence holders with their brands and approved domains. You can view the register here: Licensed operators (DGOJ). Search for the company by its legal name or domain and make sure the details match the site you intend to use. For lotteries, remember that only SELAE and ONCE are authorised to sell state lotteries.

If the brand or domain does not appear in the register, treat the site as illegal for Spain — regardless of any references it may make to foreign licences.

How to file a complaint against a DGOJ-licensed online casino

Step one. Give the casino a fair chance to resolve the issue. Use its official complaints channel, ask for a written explanation (what was done, why and under which contract clause) and keep copies of all correspondence. If you receive no answer, or the matter remains unresolved after one month, escalate it to the regulator.

Filing a complaint with the DGOJ. The DGOJ accepts complaints from players about operators holding a Spanish state licence. The entry point is the regulator’s page: Denuncias y reclamaciones — DGOJ. You can submit your case online via the electronic office (you will need a digital certificate) or on paper by post to: C/ Atocha, 3, 28012 Madrid. Attach your correspondence with the casino and any supporting evidence (screenshots, account statements, etc.).

What to expect. The indicative time frame for a decision is up to two months. The regulator may request information from the operator and, if it finds breaches, can start sanction proceedings. The DGOJ does not act as a civil court of arbitration in purely contractual disputes; for those, you may need to go to court or use an ADR scheme, if the operator participates in one. Separately, if you suspect illegal activity (unlicensed sites, .com domains targeting Spain), you can file a “denuncia” through the same portal. This supports enforcement action but is not, in itself, a claim for personal compensation.